A recent English Court of Appeal judgment could significantly broaden the circumstances in which data protection litigation can be brought – and damages can be awarded – under English law.
Background
Vidal-Hall et al v Google ([2015] EWCA Civ 311) involves claims brought by three individual users against Google. The users alleged that Google collected private information about their internet usage (“Browser-Generated Information”) via their web browser, Apple Safari, without their knowledge or consent.
The users argued that, by the automatic use of cookies in a work-around to the default privacy setting, Google was able to obtain and record Browser-Generated Information from the users’ web searches, which could potentially identify personal information such as age, gender, religious belief, and sexual preferences.
This information was then allegedly used to target certain advertisements, which were shown on the users’ computer screens and were (or might have been) seen by other people who had access to users’ devices. They alleged that this constitutes a misuse of private information, entitling them to damages, despite having suffered no actual financial loss.
The Court of Appeal’s judgment is significant because of its discussion of the following key issues:
the legal classification of a claim for misuse of private information;
whether pecuniary loss is an essential element in order to bring a claim for damages under the Data Protection Act 1998 (the “DPA”); and
whether Browser-Generated Information is personal data.
Classifying Misuse of Private Information as a Tort
First, the judgment recognised that the misuse of private information should be classified as a tort under English law.
English law has traditionally been reluctant to recognise tortious liability of this nature, preferring instead to frame matters relating to privacy as claims for breach of confidence. The recognition that the claims could be characterised as tortious in nature may indicate that the judiciary’s attitude to cases of this nature is changing.
Damages under the DPA for Non-Pecuniary Loss
Second, the judgment made important findings on the damages to which litigants may be entitled in data protection cases. Under Section 13 of the DPA, individuals who suffer damage by reason of a violation of the DPA are entitled to compensation. While, to date, an element of pecuniary (monetary) loss must have been suffered before any other type of damage can successfully be claimed, the court held that the scope of “damage” under the DPA should be interpreted more broadly. This means that damages may be awarded in cases of this nature for types of loss including emotional distress resulting from the misuse of private information, without having to first establish that pecuniary loss has been suffered by a litigant.
Browser-Generated Information as Personal Data
The DPA provides a data subject with rights in relation to their personal data. In order to claim damages under the DPA, users must establish that the Browser-Generated Information was personal data. The court determined that it is arguable that Browser-Generated Information could constitute personal data under the DPA, and that this issue warrants consideration at trial.
Analysis
It currently is not known whether Google will appeal the judgment. While the substantive hearing at a full trial would consider the factual matrix of the case in more detail, the Court of Appeal’s judgment is significant in a number of ways.
The court recognised that its decision on the classification of the misuse of private information as a tort may have broader implications, such as in relation to remedies (under which damages would no longer be discretionary), limitation periods and vicarious liability.
According to this court, establishing that damages under the DPA no longer requires pecuniary loss as a threshold could lead to an increase in litigation, because it broadens the scope for claims under the DPA.
The case also raises the possibility that Browser-Generated Information will more readily be regarded by the courts as personal data. Online sales and advertising businesses will need to carefully consider the outcome of the full trial in relation to this issue.
More widely, the case shows that the courts are taking a fresh stance in the field of data protection law in order to align the existing legislation with the issues that are faced by individuals as a result of the increasing potential uses and leveraging of their information through technological developments.